That is incredibly hard to read.
Is this better? http://bettween.com/dakami/zedshaw
Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
11–20 of 38 posts
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#12So for a whole long bunch of messages you have two people talking past each other about how the world uses passwords and the semantics of SSO and then "Is your SRP math constant time with respect to the passwords in use". Zed, seriously? This is making me sad. Best to make sure your HMAC implementation is constant time with respect to the key, too! If you think for just a little while, I think you can spot the "seman…
I wonder which order you read the thread in? I read it backwards originally.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#13I still don't get the reason why I should use autho.me over OpenID. With OpenID the site to which I want to login redirects me to my OpenID provider. So the advantages are: - I login on the site of my OpenID provider and the site to which I want to login does not learn my password. - I can check the identity of the OpenID provider before disclosing my password (e.g., by checking the SSL certificate). - The OpenID pro…
You missed that you're not going to be using the same password for each website.
Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#14I still don't get the reason why I should use autho.me over OpenID. With OpenID the site to which I want to login redirects me to my OpenID provider. So the advantages are: - I login on the site of my OpenID provider and the site to which I want to login does not learn my password. - I can check the identity of the OpenID provider before disclosing my password (e.g., by checking the SSL certificate). - The OpenID pro…
You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
If you are worried about fucking up password storage (and, good for you), it's not that hard. Read:
http://codahale.com/how-to-safely-store-a-password/
Not that it's Zed's fault that this is true†, but it's actually harder to safely host something like AUTHO.ME on a website than it is to simply use a reasonable hashing algorithm.
† I both believe this and also have to say it to avoid a sharks/jets rumble with him on HN.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#15That is incredibly hard to read.
Is this better? http://bettween.com/dakami/zedshaw
Cool, but still backwards. I think http://bettween.com/dakami/zedshaw/Jan-08-2011/desc is better.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#16Earlier quoted context omitted.
You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
If you are worried about fucking up password storage (and, good for you), it's not that hard. Read: http://codahale.com/how-to-safely-store-a-password/ Not that it's Zed's fault that this is true†, but it's actually harder to safely host something like AUTHO.ME on a website than it is to simply use a reasonable hashing algorithm. † I both believe this and also have to say it to avoid a sharks/jets rumble with him on…
I'm not worried, I was merely clarifying what the OP didn't quite understand. The article (and sentiment) is good though, and I've read it before, but apparently there's some interest in a product like Autho.me. Time will tell.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#17I don't understand autho.me, how is it supposed to be better than OpenID? In my opinion, it's worse than OpenID because with OpenID you can at least throw up a webpage at http://openid.yourcustomdomain.com/ and just edit a few meta tags when you need to switch to a different provider. I would personally only consider this if it were open source, and it's not so I can't see the draw.
> I don't understand autho.me,
"I'm scared to handle people's passwords. Here's a library that just does it for me, does the right thing, and lets me not worry about it."
That's it. Think of it like installing a plugin to handle your user accounts.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#18Earlier quoted context omitted.
You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
If you are worried about fucking up password storage (and, good for you), it's not that hard. Read: http://codahale.com/how-to-safely-store-a-password/ Not that it's Zed's fault that this is true†, but it's actually harder to safely host something like AUTHO.ME on a website than it is to simply use a reasonable hashing algorithm. † I both believe this and also have to say it to avoid a sharks/jets rumble with him on…
That's fair but I'm using OpenID (and developing a new Django OpenID authentication system) partially because I'm reasonably sure I've kept up with crypto best practices to store passwords safely but I'm also reasonably sure that most developers haven't. I'd rather people just use OpenID rather then fuck everything up.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#19I still don't get the reason why I should use autho.me over OpenID. With OpenID the site to which I want to login redirects me to my OpenID provider. So the advantages are: - I login on the site of my OpenID provider and the site to which I want to login does not learn my password. - I can check the identity of the OpenID provider before disclosing my password (e.g., by checking the SSL certificate). - The OpenID pro…
You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
Thanks for the explanation.
Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter
#20Earlier quoted context omitted.
You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.
If you are worried about fucking up password storage (and, good for you), it's not that hard. Read: http://codahale.com/how-to-safely-store-a-password/ Not that it's Zed's fault that this is true†, but it's actually harder to safely host something like AUTHO.ME on a website than it is to simply use a reasonable hashing algorithm. † I both believe this and also have to say it to avoid a sharks/jets rumble with him on…
I just want to add that nowadays "scrypt" (see http://www.tarsnap.com/scrypt.html) might be a better solution than bcrypt (suggested in the link).
("might" because scrypt is relatively new and therefore missing the numerous peer reviews bcrypt has seen).